Who is responsible for what
Fleet Log is workshop management software operated by App-Artery. There are two different relationships in it, and they carry different responsibilities.
For the records a workshop keeps in Fleet Log (its customers, their vehicles, service history and job cards), the workshop is the data controller and App-Artery is the data processor. The workshop decides what to record and why; we hold it on their behalf and act on their instructions. The terms of that arrangement are in our data processing agreement.
For the accounts of the people who sign in, and for our own billing and support records, App-Artery is the controller.
The supervisory authority for this processing is the Information Commissioner's Office in the United Kingdom.
What we hold
- Account data: your name, email address, role and the workshop you belong to, together with a hashed password. We never store a password in a form we can read.
- Workshop records entered by your workshop: customer names, telephone numbers, email and postal addresses, vehicle registrations and details, odometer readings, job cards, service history and prices.
- Operational data: sign-in times, and server logs that record requests to the service.
We do not use tracking or advertising cookies, and we do not run analytics on your use of the service. Fleet Log sets two cookies: one to keep you signed in, and one to remember whether you chose the light or dark theme. Both are strictly necessary for the service to work as you asked it to, so neither requires consent.
Why we hold it, and on what basis
Account data is processed to perform our contract with the workshop: without it there is no way to sign anyone in or decide what they may see.
Workshop records are processed on the workshop's instructions under our data processing agreement. The workshop is responsible for having its own lawful basis for holding its customers' details, which for a garage is normally the performance of its contract with that customer, or its legitimate interest in keeping a service history for a vehicle it has worked on.
Server logs and security records are processed on the basis of our legitimate interest in keeping the service available and finding out what happened when something goes wrong.
We do not sell personal data, and we do not use it to train machine learning models.
Where it is held
Fleet Log runs in Amazon Web Services' London region, eu-west-2. Customer data stays in the United Kingdom.
Data is encrypted at rest and in transit. Backups are taken daily and kept for seven days.
How long we keep it
Workshop records are kept for as long as the workshop keeps its account, and are deleted when the workshop asks us to delete them.
Deleting a customer in Fleet Log removes that customer's record together with their vehicles, job cards and service history. The deletion is immediate and it is not reversible.
There is one exception, and it is worth reading. Where a record forms part of an invoice or another accounting record, we and the workshop are required to keep it to meet a legal obligation. Tax law in the United Kingdom generally requires business records to be retained for six years. A record retained for that reason is kept for that purpose alone, and is not used for anything else.
Account data is deleted within 30 days of an account being closed, apart from anything covered by the exception above.
Your rights
Under UK data protection law you have the right to ask for a copy of the personal data held about you, to have it corrected, to have it erased, to restrict or object to how it is processed, and to receive it in a portable form.
If the data concerned is a workshop's records, the workshop is the controller and the request should go to them first; we will help them answer it. If it concerns your Fleet Log account, write to us directly.
Where a person accepted our terms on behalf of a workshop, we keep a record of who did so and when. That record is part of the workshop's contract with us and is kept even if the person's account is later closed.
You also have the right to complain to the Information Commissioner's Office. We would rather you told us first, but that right does not depend on it.
Who else processes it
Amazon Web Services, for hosting and storage, in the London region. Amazon Simple Email Service, for the emails the service sends: invitations and password resets. Both are listed as sub-processors in our data processing agreement.
We will tell workshops before we add another sub-processor.
Contacting us
Write to App-Artery using the address on the Fleet Log sign-in page. We aim to reply to anything about personal data within one working day, and to complete a rights request within one month.
We are registered with the Information Commissioner's Office as required. We will publish our registration number here.
Changes
This policy carries a version and an effective date. When we change it we publish the new version here, and where the change is significant we tell workshop owners in the application.